kobotoolbox / kpi / 23247771128 / 10

82%

master: 76%

push

github

fix(admin): prevent manual username changes for existing users in Django admin DEV-1888 (#6839)

### 📣 Summary
This PR locks down the `username` field in the Django admin panel for
existing users, preventing superusers from manually changing it and
breaking the `_userform_id` mapping in MongoDB.

### 📖 Description
Manually changing a username via the Django admin updates the relational
database but leaves MongoDB documents out of sync. Because the
`_userform_id` key in MongoDB relies on the original username, altering
it breaks submission retrieval and detaches submissions from their
correct projects.

Changes:
- Overrides get_readonly_fields in ExtendedUserAdmin (extend_user.py)
- Keeps username editable when creating a new user (obj=None).
- Dynamically appends username to `readonly_fields` when editing an
existing user record.

4565 of 11432 branches covered (39.93%)

21452 of 34760 relevant lines covered (61.71%)

0.62 hits per line